Mar 26 2012

IT Governance helps SMEs protect themselves from cybercrime

Category: ISO 27k — DISC @ 1:45 pm

Check out the ITG site for details

IT Governance Ltd, the global provider of cyber security management solutions, has announced a value-add offer in March. Organisations that buy the No3 ISO27001 Comprehensive Toolkit before the end of March will receive the Cybersecurity Self Assessment Tool free, making double savings on resource and time.

The No3 ISO27001 Comprehensive Toolkit contains highly practical books, document templates and risk assessment tool, also providing a 100% return on investment. It helps organisations tackle cybersecurity issues quickly and efficiently, whilst considerably improving their cybersecurity defences.

The recent Symantec Threat Awareness Survey uncovered that over 50% of the 1,900 SME’s interviewed, thought that they were immune to cybercrime because they were too small.

However, Symantec’s report found that since 2010 40% of all attacks were on SME’s. Ross Walker, Symantec director of small business for Symantec UK, commented “hackers are going after ‘low hanging fruits’ these are the companies who are less security aware and do not have the proper defences in place”.

Alan Calder, CEO of IT Governance, says “The best way to build robust and effective cyber defences is by implementing ISO27001, the world’s cybersecurity standard. An ISO27001-compliant Information Security Management System (ISMS) promotes customer confidence, helps vendors win new business and improves organisational efficiency”.

The easiest way to implement an ISO27001-compliant ISMS, especially for SMEs, is with the No 3 Comprehensive ISMS ISO27001 Toolkit. It provides organisations with all the tools they will need for the implementation of an information security management system (ISMS).

The No 3 Comprehensive ISMS ISO27001 Toolkit includes copies of the three key standards (ISO27001, ISO27002 and ISO27005), the Risk Assessment Tool (vsRisk™), the Documentation Template Toolkit and manuals that describe in practical detail how each aspect of the ISMS should be tackled.

One user of the Toolkit said: “Using the templates was the only way that we could deliver a first edition ISMS in under six months. Our deliverable was a work in progress, but miles ahead of where they would have been without the templates”.

Organisations that buy the No 3 Comprehensive ISMS ISO27001 Toolkit before the end of March will receive the Cybersecurity Self Assessment Tool free. It enables any organisation to quickly assess and demonstrate which areas of the organisation are up to scratch and where more attention is required.

Organisations can purchase the ISO27001 Comprehensive Toolkit here!

Tags: Information Security Management System, isms, iso 27001, iso 27002, ISO 27004, iso 27005, iso 27006, iso27003

Mar 20 2012

Risk Management and Business Life Cycle

Category: Security Risk Assessment — DISC @ 1:29 pm

  • Risk management is a business process and all the business decisions should have a business development life cycle
  • Risk management is a management responsibility, must be supported by senior management and that concept of Ownership of assets must be established
  • In Pre screening of critical assets, assets sensitivity must be established based on business, legal and contractual values for confidentiality, integrity and availability. this risk analysis process will determine which critical assets needs to go through the risk assessment process
  • Organizaions use risk assessment to determine what threats exist to a specific asset and the associated risk
  • The risk acceptance threshold will provide the organization with the information needed to select effective control measures or safeguards to lower the risks to an acceptable level
  • Risk is a function of the probability that an identified threat will occur and then the impact that threat will have on the asset

    • Risk Assessment should include the followings primary steps:
    * Critical Asset Sensitivity (impact analysis) level affecting business, contractual and legal imapct
    * Threats identified
    * Vulnerabilities related to the threats
    * Probablity of occurance that the specific threat will exploit the given vulnerability
    * Impact of the loss if the specific threat will exploit the given vulnerability
    * Risk level identified
    * Control recommendations based on risk acceptance
    * Results documentation

    How to Complete a Risk Assessment in 5 Days or Less

    Tags: Risk Assessment, Security Risk Assessment, Tom Peltier

    Mar 10 2012

    Security Controls and Principles

    Category: Information Security — DISC @ 11:01 pm

    For security controls to be effective, apply the pillars of information security

    — Principle of least privilege
    — Separation of duties
    — Economy of mechanisim
    — Complete mediation
    — Open design

  • Least privilege is Need to Know principle or default deny -essentially, don’t permit more then required to meet the business requirement to avoid extra risk
  • For separation of duties we don’t want to give any individual so much control that they become a security risk without proper check and balance inplace
  • The principle of economy of mechanism basically says that more complexity we introduce into security system, creates potential for failures
  • Complete Mediation says that control cannot be bypassed – no unofficial back doors
  • Open design – the securty of the system must not be based on the obscurity of the mechanism

    • Information Security: Principles and Practice

    Mar 02 2012

    What makes a good Information Security Policy?

    Category: Security policy — DISC @ 12:50 pm

    Good policies should have five distinct attributes to become a successful and reasonably accepatable organization wide.

    Specific: A policy must address a specific issue or objective clearly and thoroughly.

    Measureable: To be effective, policy must have some condition of measuring adherence to the control. If people are not adhereing to policy then we may need better controls or perhaps better training program.

    Achievable: To follow the policy, employee must have enough resources, tools and training to make policy objectives achieveable

    Realistic: How realisticcally can we expect the policy will be followed and employee will be able to achieve his/her business objectives without any issues. This is where there is a need to balance security and availability. The question we need to ask how much should we Lock it Down or Free it Up?

    Time Based: Specify when policy takes effect, when review will occurs and when conformance become required

    To remember these five attributes here is an acronym “SMART”

    Writing Information Security Policies

    Feb 23 2012

    21st Century Chinese Cyberwarfare

    Category: cyber security — DISC @ 2:21 pm

    The UK’s 2010 National Security Strategy identified cyberattacks as one of the four highest-priority risks faced by the UK. President Obama has declared cybersecurity as one of the most serious economic and national security challenges the US faces as a nation.

    There is an Advanced Persistent Threat (APT) posed by organised crime and state level entities, targeting large multi-national corporations and foreign governments. Organisations of all sizes can suffer collateral damage. China has been regularly identified in the press as a major player in modern cyberwar activities but, until now, little has been written to describe the depth and severity of this threat.

    21st Century Chinese Cyberwarfare, from IT Governance Publishing, is a comprehensive and in-depth review of the Chinese role in cyberwarfare. Drawing on a combination of cultural, historical, business, linguistic and personal experience, the book attempts to explain China to the uninitiated. It describes how the combination of Chinese Communism and the unique cultural and linguistic heritage of the People’s Republic of China are driving Chinese cyber activity.

    The author, Lieutenant Colonel (Ret’d) William Hagestad II, is an internationally recognised subject matter expert on the Chinese People’s Liberation Army and Government Information Warfare. He advises international intelligence organisations and multi-national commercial enterprises with regard to their internal IT security governance and external security policies, making him the ideal person to write this book.

    21st Century Chinese Cyberwarfare is the first book to gather the salient information regarding the use of cyberwarfare doctrine by the People’s Republic of China, highlighting the increasing threat it imposes to the western world and the fact that Chinese cyberwarfare is a clear and present danger that can no longer be ignored. The book should be read by many, from individuals through to governmental departments, with everyone finding benefit in it.

    William Hagestad II adds, “My intent with this book was to introduce my readers to the Chinese culture, history and language through the lens of the People’s Liberation Army (PLA) information security & cyber warfare initiatives as a basis for economic, political and military hegemony by the Chinese Communist Party.”

    Alan Calder, CEO of IT Governance comments, “This book provides a fascinating and comprehensive study of the evolution and current nature of the Chinese approach to war ‘by other means’, conducted in what the Chinese see as the fifth sphere of war: cyberspace. ‘Know your enemy’ is a good starting point for any defence strategist and this book is an outstanding contribution to a better understanding of cyber security challenges that should be read by information security professionals the world over.”

    21st Century Chinese Cyberwarfare can be purchased in local currency from the ITG website

    Related story

    NATO Drafting Cyber Warfare International Law Manual

    Feb 21 2012

    50 Top IT Project Management Challenges

    Category: Information Security,ISO 27k — DISC @ 10:58 pm

    A summary of the challenges facing today’s IT project manager
    Discussions on project management forums highlight many of the challenges facing a project manager during the course of a project. Unclear requirements, scope creep and undefined roles are well-trodden issues that can derail a project. Other challenges are less obvious, often more subtle, but equally destructive.

    Facing up to the challenges
    This book offers a focused and concise summary of 50 challenges facing today’s IT project manager. The authors draw on years of practical experience (rather than classroom theory) to outline these challenges and offer useful tips and advice on how to deal with them.

    Challenge and response
    Readers of this book will be better equipped to respond to key project management challenges, including

    • Building the team – getting the right resources, matching skills/knowledge, defining roles and responsibilities.
    • Project scope – clarifying assumptions, avoiding ambiguity, getting the time/cost estimates right.
    • Politics – communicating with management and stakeholders, dealing with conflict, handling interference and micro-managing.
    • Risk awareness – identifying inside/outside influences, recognising inbound and outbound dependencies.
    • Time management – using the right planning tools, balancing work versus meetings.
    • Failure – handling the blame game, protecting the team, rescuing the project.

    This book condenses into a handy summary much of the information and advice that can be found in project management related books and discussion forums. It is an ideal reference for anyone involved in IT project management, from professional service organisations (PSO) and project management offices (PMO), through to active project managers and studying graduates.

    Buy this book and deliver your next project on time, on budget and to specification!

    About the authors

    Premanand Doraiswamy has over 14 years’ experience working in IT project management with Fortune 500 companies in various industries and is the author of IT Project Management – 30 Steps to Success, also published by IT Governance.

    Premi Shiv is a quality assurance specialist with 7 years’ experience in IT processes and management solutions. With an optimistic approach and organisational skills, she has carved a niche in quality assurance.

    Feb 13 2012

    What Is a Security Incident and How to handle one

    Category: Security Incident — DISC @ 2:13 pm

    A security incident is a computer, network, or paper based activity which results (or may result) in misuse, damage, denial of service, compromise of integrity, or loss of confidentiality of a network, computer, application, or data; and threats, misrepresentations of identity, or harassment of or by individuals using these resources.

    Examples of incidents may include but not limited to the followings:
    • Root-level attacks on networking infrastructure, critical systems, or large, multi-purpose or dedicated servers
    • Compromise of privileged accounts on computer systems
    • Denial-of-service attacks on networking infrastructure and critical systems
    • Attacks launched on others from within umn.edu
    • Compromise of individual user accounts or desktop (single-user) systems
    • Scans of University systems originating from the Internet
    • Spam and mail forgery that originates from, or is relayed through umn.edu
    • Viruses, Worms and Trojan Horses

    Computer Security Incident Handling Guide

    Feb 11 2012

    Intel IT’s New Information Security Strategy

    Category: Security organization — DISC @ 11:52 am

    Intel IT – Protect to Enable: Learn about Intel’s IT best practices and Intel’s new information security strategy…. a new architecture that is designed to increase productivity, agility and innovation, while actually decreasing risk.

    Feb 07 2012

    A successful ISO27001 cert case study and benefits rendered

    Category: ISO 27k — DISC @ 11:39 am

    Check out the ITG site for details

    London Pensions Fund Authority (LPFA) achieves ISO27001 and ISO14001 certifications six months ahead of deadline

    The London Pensions Fund Authority (LPFA), based at Royal Mint Court, London, is today announcing a remarkable achievement in standards compliance. A leader in the provision of pension administration for the Local Government Pension Scheme, and with its own pension fund worth £4.1bn, LPFA is leading the way in the City of London by recently becoming certified to the ISO27001 Information Security and ISO14001 Environmental Management System standards – six months ahead of project schedule, and with a near-perfect score.

    These prestigious awards are the culmination of a fast-track project supported by professional services firm IT Governance, a leader in international standards compliance and best practice, serving clients in the UK public and private sectors.

    In the highly competitive global market for pension fund administration, cost-effectiveness and efficiency are vital components for success. LPFA is, therefore, a cost-conscious and well-run organisation, but also one that is aware of its responsibilities when it comes to protecting the security of data and taking a leadership position in improving the organisation’s environmental impact. For these reasons, the LPFA Board adopted international standards and achieved compliance with the ISO27001 Information Security and ISO14001 Environmental Management Standards.

    For LPFA, Les Higgs, LPFA’s Programme and ICT Manager, comments: “Our thanks go to IT Governance, whose consultant, Nick Orchiston, enabled us to achieve certification in record time, and – on a personal note – to Lauren McHugh, who has worked so diligently to inform and successfully engage our colleagues at LPFA. The results speak for themselves: after rigorous assessment, the BSI auditor found only three minor non-conformities in the implementation of two weighty international standards. They certificated LPFA to ISO27001 and ISO14001 standards on our first attempt, six months ahead of our project completion date.”

    Mike Taylor, LPFA’s Chief Executive, said: “I am delighted that LPFA has managed to achieve ISO accreditation six months ahead of deadline. Key elements, such as enhanced data security and environmental considerations, have become part of life across the whole organisation. This accreditation should give confidence to all Fund members and clients that their information is in good hands. The process had total commitment from the project team, IT Governance and all staff, and it was this that led to a successful implementation.”

    “For IT Governance, Steve Watkins, Director, Training & Consultancy, said: “ISO27001 compliance, when approached correctly, provides clear commercial benefits. The risk-based approach means that it is the sensitive information – for example, personal information, bank details, contracts and other confidential material – which is appropriately protected, thereby minimising the risk of reputational damage and providing reassurance to clients, whilst also ensuring the information is available as and when it is needed. Further, certification to ISO27001 demonstrates to clients, staff and stakeholders that the organisation has a systematic approach to managing the security of information, considering the implications of people, processes and technology. We believe that by adopting this standard and seeking accredited certification, financial companies can demonstrate their commitment to respecting clients’ sensitive data.”

    The certification pathway to ISO27001 involved extensive risk management evaluation, business resilience planning and ensuring data security standards set by client companies are met and exceeded by delivering industry-leading IT protocols. LPFA will be independently inspected every six months to ensure it is up to speed with the latest data protection and industry requirements – with strong and effective measures to help to protect confidential data and prevent fraud.

    The ISO14001 Environmental Management System has helped LPFA to be more environmentally friendly, providing managers with guidance on how to measure consumption and reduce waste. An effective programme to reduce, re-use and recycle has produced top and bottom line benefits by making tangible cost savings, reducing environmental impact and enhancing the organisation’s environmental credentials, winning more business: a fact demonstrated by LPFA’s success in securing commercial tenders as a result of the organisation’s certification in 2011.

    IT Governance offers an integrated professional services approach to standards adoption, project development and compliance. The UK-based company provides consultancy advice, coaching and mentoring, knowledge transfer, training programmes and an extensive range of documentation toolkits, software, e-learning and self-help publications designed to speed up compliance projects.


    Checkout a comprehensive ISO 27001 ISMS Toolkits from IT Governance

    Jan 31 2012

    Top nine cyber security threats for 2012

    Category: cyber security,ISO 27k — DISC @ 12:37 pm

    1. Cyber security decisions will be based on security, rather than regulations. The growing infrastructure of hackers and data breaches will mean businesses will be protecting themselves out of necessity, rather than regulation
    2. The rise of ‘cyber brokers’. There will be an increasing supply and demand for compromised machines containing sensitive data.
    3. An increase in hackers automating social media attacks
    4. Time will be wasted as IT professionals profess regulation of end-user devices and cloud data access, instead of controlling data at the source
    5. There will be inadequate security around big data (NoSQL) inhibiting integration as third party components within companies.
    6. Organizations will have to look for tools to protect and control access, as internal collaboration suites (such as Microsoft Sharepoint and Jive) might be deployed in ‘evil twin’(external) modes.
    7. In regards to DDoS, attackers will increase sophistication and effectiveness by shifting from network level to application level attacks (even business logic level attacks), citing increasing exploitation of SQL injection vulnerabilities as one of the modes.
    8. The HTML 5 standard will enable hackers to exploit vulnerabilities in the browser’s themselves to install malware.
    9. There is currently a rise in attacks which target the worldwide infrastructure that supports SSL. Imperva expect these attacks to reach a tipping point in 2012 which, in turn, will invoke a serious discussion about real alternatives for secure web communications.

    Source: Imperva, Works Management
    To help you combat cyber threats, you can download free white paper ‘Cyber Security: A Critical Business Risk’ here >>>

    The best way to protect you and your business for 2012 is to implement ISO 27001; the international best practice for an Information Security Management System (ISMS).
    The easiest way to do this is with this ISO27001 toolkit

    Jan 29 2012

    How to tackle cybersecurity

    Category: cyber security — DISC @ 10:08 pm

    By SEN. KAY BAILEY HUTCHISON, SEN. CHUCK GRASSLEY, SEN. SAXBY CHAMBLISS and SEN. LISA MURKOWSKI @ POLITICO

    The Senate is about to consider cybersecurity legislation. Ensuring the integrity and safety of our nation’s critical infrastructure is a bipartisan issue that Congress and President Barack Obama must work together to tackle.

    There is a right way and a wrong way to address cybersecurity. The right way is for the government and private sector to work together to solve problems, help the free flow of information between network managers and encourage investment and innovation in cybersecurity. The wrong way is new, heavy-handed, costly regulation and further expansion of government bureaucracy that will slow our nation’s response to cyberthreats and increase vulnerabilities.

    First, the government must do a better job of protecting its own systems. These networks contain some of our most sensitive data and control some of our most important facilities. To improve network security, there are two areas in which Congress could legislate immediately.

    The first is reforming the Federal Information Security Management Act. This law, crafted to improve the security of government information systems, is a decade old and should be updated with a real-time monitoring system.

    The second critical component is leveraging our key federal research institutions — including national laboratories, the National Science Foundation and the Defense Advanced Research Projects Agency — to maintain U.S. global leadership in cybersecurity innovation. By developing leading-edge cybersecurity technologies, the United States can stay one step ahead of cyberthreats, whether from hackers, terrorists or nation-states.

    Though improving the security of government systems is a crucial first step, it is not enough. The federal government does not own the overwhelming majority of the infrastructure that could be the target of cyberthreats.

    For example, more than 1,800 entities own or operate components of our nation’s electrical grid. To secure critical infrastructure, we should focus on strengthening our existing oversight frameworks instead of creating duplicative regulatory regimes that give additional agencies, such as the Department of Homeland Security, broad new authorities to regulate.

    In fighting cyberthreats, forewarned is forearmed. The single most effective way of advancing cybersecurity is sharing cyberthreat information between the government and industry, as well as within the private sector. Yet this collaborative relationship is undermined by our laws and policies — which put the government and private entities at a severe disadvantage in proactively identifying and countering cyberthreats.

    The government often collects valuable information about potential threats that can and should be shared with private entities — without compromising national security. Companies should be free from legal barriers and constraints that prevent or deter them from voluntarily sharing cyberthreat information with their peers or with the government.

    As a government, we should work with the private sector to help them respond to cyberthreats. Not punish them for being victims of cyberattacks or for working with others to prevent future attacks.

    In addition, our nation’s criminal laws must be updated to account for the growing number of cybercrimes. We support legislation to clarify and expand the Computer Fraud and Abuse Act — including increasing existing penalties, defining new offenses and clarifying the scope of current criminal conduct.

    These changes will ensure that our criminal laws keep pace with the ever-evolving threats posed by cybercriminals.

    This approach should lead to significant strengthening of our nation’s cybersecurity and quickly gain bipartisan support in Congress. Unfortunately, the administration’s proposal would create new, massive and ill-defined regulatory burdens — forcing many private companies that work with digital networks to be regulated by DHS.

    Such broad new regulatory powers will, in turn, require a dramatic and costly expansion of the federal bureaucracy and its regulatory reach. This expansion will not help secure America’s networks and will harm both innovation in cybersecurity and our nation’s already suffering economy.

    Now is not the time to increase the size and cost of the federal bureaucracy. We need to focus instead on reforming existing federal government entities, streamlining and targeting regulatory efforts, looking for efficiencies and strengthening our nation’s capacity to deal with cyberattacks.

    The administration’s proposal is ultimately a costly and heavy-handed regulatory approach. It will not work and it won’t pass Congress. We hope the president will work with us on a more collaborative approach between government and business to effectively address the critical issue of cybersecurity.

    Jan 17 2012

    An Introduction to Hacking & Crimeware

    Category: Cybercrime — DISC @ 10:06 am

    An Introduction to Hacking & Crimeware: A Pocket Guide

    Cybercrime is on the rise. Unchecked, it could destroy the entire global cyber infrastructure and wipe out many businesses. We need to defend ourselves against it, and we must fight back.
    Know your enemy

    An Introduction to Hacking & Crimeware is a comprehensive guide to the most recent and the more serious threats. Knowing about these threats will help you understand how to ensure that your computer systems are protected and that your business is safe, enabling you to focus on your core activities.

    Download your eBook copy today!

    Jan 17 2012

    The Big Shift to Cloud-based Security

    Category: Cloud computing — DISC @ 8:58 am

    Keeping IT systems secure and running within regulatory compliance mandates, especially for mid-sized and even small businesses, seems next to impossible. There are many reasons for this — but fortunately, several recent technological trends show that it doesn’t have to be this way.

    This paper covers how small and medium-sized organizations can manage their IT risks and maintain regulatory compliance with minimal staff and budget.

    Download Paper Now

    Managing Risk in the World of Cloud Computing

    Jan 15 2012

    The Mobile Security Show: Improving Mobility Infrastructure Security Standards

    Category: Mobile Security,Smart Phone — DISC @ 10:40 pm

    For more episodes of The Mobile Security Show, visit http://techchannel.att.com/showpage.cfm?Mobile-Security-Show

    A discussion on Mobility Standards moves towards a rousing conversation about mobility and privacy. Originally recorded at NYU Poly on November 16, 2011.

    Topic: “Dealing With Exploitable Mobile Device Vulnerabilities”
    Hosts:
    Veronica Belmont – Technology Video Host
    Dino Dai Zovi – Information Security Professional & Researcher

    Panelists:
    Edward Amoroso, AT&T Inc., Chief Security Officer
    Martin Roesch, Sourcefire, Founder and CTO
    Uma Chandrashekhar, Bell Labs, Alcatel-Lucent, VP Security, Reliability, & Eco-Environmental Eng.
    Justin Cappos, NYU-Poly, Assistant Professor, Computer Science & Engineering

    Dec 26 2011

    Tackle cyber security in 2012 with this eBook

    Category: cyber security — DISC @ 7:46 pm

    2011 will be remembered as the year of the hacker. Large, well know brands were targeted like never before causing a media frenzy and major concern for consumers around the world.
    Make your New Years-Resolution to tackle Cybersecurity. Get a head-start. Buy this book and let the master strategists show you how to fight the information war!

    Tis the season to be jolly,
    Put an eBook in your trolley,
    In the warm without a brolly,
    Don’t miss out – you could be sorry!”

    Assessing Information Security: Strategies, Tactics, Logic and Framework
    by Andrew Vladimirov, Konstantin Gavrilenko and Andriej Michajlowski.


    RRP: $69.99

    Price: $49.95
    You Save: $20.04


    Dec 20 2011

    ISO/IEC 27001 – BSI interviews Henk de Vries

    Category: ISO 27k — DISC @ 9:59 am

    BSI and Rotterdam school of management, Erasmus university conducted a research study about ISO/IEC 27001 Information technology. Security techniques. BSI interviewed Henk de Vries who is one of the experts behind the study.

    ISO27001 (ISO 27001) ISMS Requirements (Download now)

    ISO27002 (ISO 27002) Code of Practice for ISM (Download now)

    To Download a copy of ISO27003 – Implementation Guidance

    To Download a copy of ISO27004 – Information Security Metrics

    ISO27005 (ISO 27005)ISRM Standard (Download now)

    ISO/IEC 27006 ISMS certification guide (Download now)

    Tags: iso 27001, iso 27002, iso 27003, ISO 27004, iso 27005, iso 27006

    Dec 15 2011

    To Be or Not to Be CyberSecurity Expert

    Category: cyber security — DISC @ 12:32 pm

    History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It’s always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you’ll be glad you did. – Bruce Schneier

    Realise the benefits of Internet technologies, while ensuring your company is protected from the associated risks.

    If you want to make the Internet work for your business, you need to take the right precautions – Buy this book today!

    Realize the benefits of Internet technologies, while ensuring your company is protected from the associated risks!

    An effective risk management strategy is vital to your company s survival
    Internet technologies have revolutionized the way that business is conducted. However, these innovations expose your business to various risks. Inadequate security can lead to the theft of customer data and, in the event of technological failure or a cyberattack, your business could lose its ability to function altogether. An effective risk management strategy is, therefore, vital to your company s survival.

    Understand the origins of cyber risks and develop suitable strategies for their management
    Cyber Risks for Business Professionals: A Management Guide is a general guide to the origins of cyber risks and to developing suitable strategies for their management. It provides a breakdown of the main risks involved and shows you how to manage them. Covering the relevant legislation on information security and data protection, the author combines his legal expertise with a solid, practical grasp of the latest developments in IT to offer a comprehensive overview of a highly complex subject.

    Expert guidance examining the operational and technological risks
    Drawing on interviews with experts from Clifford Chance, Capgemini and Morgan Stanley amongst others, the book examines the operational and technological risks alongside the legal and compliance issues. This book will be invaluable to lawyers and accountants, as well as to company directors and business professionals.

    Dec 06 2011

    vsRisk The Ultimate Cyber Security Risk Assessment Tool

    Category: ISO 27k,Security Risk Assessment — DISC @ 11:05 am

    With over 10 years in the market and 2,500 global downloads, vsRiskTM has been helping organizations all over the world carry out successful risk assessments.
    Risks assessment is the core competence of cyber security management. Every decision you make must be proportionate to the actual risk your organization faces. You must therefore assess risks on a structured asset-by-asset basis – and experience proves you need to save time and money with a risk assessment tool that automates and simplifies this process.
    vsRisk is the definitive ISO27001:2005-compliant risk assessment tool which will help you become cybersecure

    vsRisk – The Definitive Cyber Security Risk Assessment Tool
    The vsRisk Assessment Tool has been designed with the user in mind to effectively identify, analyze and control their actual information risks in line with their business objectives. Key features of vsRisk include:
    • Assessing key areas such as Groups, Assets and Owners
    • Capturing your IS policy, objectives and ISMS scope
    • In-built audit trail and comparative history
    • Assessesing attributes on Confidentiality, Integrity, and Availability, in relation to Business, Legal, Contractual
    • Comprehensive reporting and gap analysis

    Alan Calder, CEO of Vigilant Software, talks you through the risk assessment process using vsRisk
    Watch the video now >>>

    This unique risk assessment tool helps you get on top of the critical risk assessment phase of your ISMS project and, most importantly, sets you up for future risk assessments as well.
    Join the professionals and orders your today >>>

    vsRisk and Security Risk Assessment

    Dec 02 2011

    How to get certified against ISO 27001?

    Category: ISO 27k — DISC @ 11:39 am

    ISO27001 ISMS Requirements (Download now!)

    By Dejan Kosutic

    You have been implementing ISO 27001 for quite a long time, invested quite a lot in education, consultancy and implementation of various controls. Now comes the auditor from a certification body – will you pass the certification?

    This kind of anxiety is normal – you can never know whether your ISMS (information security management system) has everything the certification body is asking for. But what is it exactly the auditor will be looking for?

    First, the auditor will perform the Stage 1 audit, also called the “Document review” – in this audit, the auditor will look for the documented scope, ISMS policy and objectives, description of the risk assessment methodology, Risk Assessment Report, Statement of Applicability, Risk Treatment Plan, procedures for document control, corrective and preventive actions, and for internal audit. You will also have to document some of the controls from Annex A (only if you found them applicable in the Statement of Applicability) – inventory of assets (A.7.1.1), acceptable use of assets (A.7.1.3), roles and responsibilities of employees, contractors and third party users (A.8.1.1), terms and conditions of employment (A.8.1.3), procedures for the operation of information processing facilities (A.10.1.1), access control policy (A.11.1.1), and identification of applicable legislation (A.15.1.1). Also, you will need records of at least one internal audit and management review.

    If any of these elements are missing, this means that you are not ready for Stage 2 audit. Of course, you could have many more documents if you find it necessary – the above list is the minimum requirement.

    Stage 2 audit is also called the “Main audit”, and it usually follows a few weeks after Stage 1 audit. In this audit the focus will not be on the documentation, but if your organization is really doing what your documentation and ISO 27001 say you have to do. In other words, the auditor will check whether your ISMS has really materialized in your organization, or is it only a dead letter. The auditor will check this through observation, interviewing your employees, but mainly by checking your records. The mandatory records include education, training, skills, experience and qualifications (5.2.2), internal audit (6), management review (7.1), corrective (8.2) and preventive (8.3) actions; however, the auditor will be expecting to see many more records as a result of carrying out your procedures.

    Please, be careful here – any experienced auditor will notice right away if any part of your ISMS is artificial, and is being made for the purpose of audit only.

    OK, you knew all this, but it still happened – the auditor found major non-conformity and told you that ISO 27001 certificate will not be issued. Is this the end of the world?

    Certainly not. The process goes like this – the auditor will state the findings (including the major non-conformity) in the audit report, and give you the deadline until which the non-conformity must be resolved (usually 90 days). Your job is to take appropriate corrective action; but you have to be careful – this action must resolve the cause of the non-conformity, otherwise the auditor might not accept what you have done. Once you are sure the right action is taken, you have to notify the auditor and send him/her the evidence of what you have done. In the majority of cases, if you have done your job thoroughly, the auditor will accept your corrective action and activate the process of issuing the certificate.

    There you go – it took some time, but now you are a proud owner of the ISO/IEC 27001 certificate. (Be careful though – the certificate is valid for three years only, and can be suspended during that period if the certification body identifies another major non-conformity on the surveillance visits.)

    Nov 25 2011

    Secretary of Defense William S Cohen on the 3 Main Threats

    Category: cyber security — DISC @ 10:41 pm

    Secretary of Defense William S Cohen on the 3 Main Threats Facing the United States, secretary Cohen emphasis cyber threat is the most dangerous out of three. Click the link above to watch his video on three main threats.

    Famous quotes from Secretary Cohen:
    While we are not and cannot become the world’s policeman, neither can we become a prisoner of world events, isolated and tucked safely away in a continental cocoon.

    There is no foolproof security that we can provide. But to say that we can’t protect against everything doesn’t mean that we shouldn’t protect against those that can cause us catastrophic harm.

    For while the threat of nuclear holocaust has been significantly reduced, the world remains a very unsettled and dangerous place.

    Terrorism is escalating to the point that Americans soon may have to choose between civil liberties and more intrusive means of protection.

    We will not win the war on terror through military action. The sharing of information and intelligence will be vital to protecting our country.

    The more reliant we become upon computers and information systems, the more vulnerable we become to cyber-terrorists who will conceive unlimited ways to cripple our infrastructure, our power grids, our banking systems, our financial markets, our space based communications systems.

    Related books by Secretary of Defense William S Cohen

    « Previous Page — Next Page »